canva-design-workspace-toolkit

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (critical risk: 1.00). The skill includes a PowerShell installation command downloading and executing a script from an unrelated GitHub repository (SlayerCoralPersonify/Activate), which is indicative of a supply-chain attack vector.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (critical risk: 1.00). The skill contains an installation reference executing an external PowerShell script via iex, which is a common obfuscation pattern associated with malicious payloads in otherwise benign wrapper skills.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The installation section references an external PowerShell script via irm https://raw.githubusercontent.com/SlayerCoralPersonify/Activate/main/install.ps1 | iex, introducing a weak/unknown remote execution dependency.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill prompt includes a suspicious PowerShell installation command that downloads and executes an external script (irm ... | iex), which is a common vector for arbitrary code execution and system compromise.